docs: simplify customer onboarding and require OSConfig 1.4.10 for MC packages

CHANGELOG.md

@@ -28,6 +28,19 @@
 
 ## [Unreleased]
 
+### Documentation
+
+- Lead the README and documentation site with release downloads, edition
+  selection, and a first saved baseline without CLI, admin access, or Azure.
+  Keep advanced packaging and contributor references available without making
+  them prerequisites; clarify unsigned-download risks and report terminology.
+- Require the **Microsoft.OSConfig PowerShell module 1.4.10+** on the machine
+  creating Machine Configuration packages, separately from PowerShell 7 and
+  GuestConfiguration. Centralize Audit-first packaging, reject missing/older
+  modules before MOF version resolution, preserve exact-version binding and
+  immutable ZIP/hash guidance, and label the 1.4.3 patch helper historical.
+  This does not claim that all upstream baseline issues are resolved.
+
 ### Security
 
 - Update DOMPurify to 3.4.16, Axios to 1.20.0, ip-address to 10.7.2,

INSTALL.md

@@ -1,5 +1,12 @@
 # Installing ConfigForge and the OSConfig CLI
 
+Start by installing the desktop app. **Stop after the first-baseline
+walkthrough if you only want to author or review baselines.** The CLI and
+Machine Configuration packaging tools are optional, separate workflows.
+
+> ConfigForge is experimental, community-maintained, and not an officially
+> supported Microsoft product. It is not intended for production use.
+
 ConfigForge has two editions:
 
 - **Full edition** — Windows + Linux from the `main` branch. Authoring works without the CLI; Deploy, Audit, and Revert require `oscfg`.
@@ -20,6 +27,53 @@ work without `oscfg`. This is Editor mode, and it is the default on first
 launch. In the Full edition, the Welcome dialog and footer health pill surface
 CLI state so you can switch to device operations after installing the CLI.
 
+## Install the desktop app
+
+1. Open the [ConfigForge releases](https://github.com/Azure/ConfigForge/releases)
+   page. Choose **Full v0.3.103** for Windows/Linux x64 or
+   **Author mac-v0.3.101-author.1** for Apple Silicon macOS. Expand **Assets**
+   and download the appropriate installer/archive and published checksum
+   manifest. Source-code archives are for contributors, not app installers.
+2. Compare the download's SHA-256 with its entry in the release checksum
+   manifest. For example, in PowerShell, replace the filename below with your
+   downloaded asset:
+
+   ```powershell
+   Get-FileHash -LiteralPath '.\downloaded-installer.exe' -Algorithm SHA256
+   ```
+
+   On Linux use `sha256sum <downloaded-asset>`; on macOS use
+   `shasum -a 256 <downloaded-asset>`. Stop if the checksum differs.
+3. Follow your organization's software policy before installing an unsigned
+   app. Windows users can run the installer or extract the portable archive.
+   Linux users should choose the package format for their distribution, or
+   extract the portable archive. For macOS, see [Author edition](#macos-author-edition).
+4. Open ConfigForge without elevation for authoring. If the Welcome dialog
+   appears, choose **Author baselines anywhere**, then follow
+   [Your first baseline](./docs/src/quick-start/first-manifest.md).
+
+**Unsigned-download warning:** these artifacts have no code-signing identity;
+macOS builds are also not notarized. A checksum confirms integrity relative to
+the published file, not that the app is safe. Do not disable operating-system
+security protections globally. If Windows SmartScreen blocks the installer,
+review its source and checksum and obtain approval before using any per-file
+override. On managed devices, ask your administrator rather than bypassing
+policy. Building from reviewed source is an alternative, not a safety guarantee.
+
+## Optional local device operations
+
+The following CLI setup is only for the Full edition's **Deploy**, device
+**Audit**, and **Revert**. Test on a disposable machine that matches the
+baseline's target OS. Registration alone does not apply a baseline.
+
+For **creating Azure Machine Configuration packages**, use the separate
+[packaging guide](./docs/src/user-guide/machine-configuration.md): it requires
+PowerShell 7, the GuestConfiguration toolkit, and the **Microsoft.OSConfig
+PowerShell module 1.4.10 or later** on the packaging machine.
+`Install-Module -Name Microsoft.OSConfig -MinimumVersion 1.4.10` installs that
+module; `winget install Microsoft.OSConfig` below installs the **CLI**, not
+the PowerShell packaging prerequisite.
+
 ---
 
 ## Upstream source
@@ -114,9 +168,10 @@ the app into Deploy-capable mode without restarting.
 4. ConfigForge will auto-detect the binary on next launch (or
    click Recheck in the app).
 
-Deploy/Audit operations require root (or sudo) for the same reasons they do
-on Windows. The in-app health pill will surface "admin required" when
-unprivileged.
+Deploy/Revert require root or equivalent privileges. Audit permissions depend
+on the resource being read; protected settings may also require elevation.
+An unread setting is not evidence of compliance. This is separate from
+Machine Configuration package testing, which requires a privileged session.
 
 ---
 
@@ -132,19 +187,23 @@ prerelease on the
 [Azure/ConfigForge releases](https://github.com/Azure/ConfigForge/releases)
 page. Users can also build the tagged source from the repository.
 
-The app is unsigned and not notarized. Copy **ConfigForge Author.app** to
-`/Applications`, then clear the browser-added quarantine attribute once:
+The app is unsigned and not notarized. Verify its release checksum before
+opening the DMG and copying **ConfigForge Author.app** to `/Applications`.
+Gatekeeper may block it. Prefer your organization's approved per-app process
+(for example, **System Settings → Privacy & Security → Open Anyway**, when
+available and permitted).
 
-```bash
-xattr -cr "/Applications/ConfigForge Author.app"
-```
-
-If that command reports a permission error, use:
+Only if you have verified the download, accept the unsigned-app risk, and
+your policy permits it, remove the quarantine attribute from this app alone:
 
 ```bash
-sudo xattr -rd com.apple.quarantine "/Applications/ConfigForge Author.app"
+xattr -rd com.apple.quarantine "/Applications/ConfigForge Author.app"
 ```
 
+This removes a Gatekeeper quarantine check; it does not sign or notarize the
+app. Do not clear all attributes, disable Gatekeeper globally, or escalate a
+permission failure just to bypass policy. Ask your administrator if blocked.
+
 The Author edition supports baseline authoring, validation, import, Diff,
 Benchmark Mapping, history, rationale, and Audit Pack PDF/Markdown export. It
 does not expose device Deploy, Audit, Enforce, Revert, elevation, device